PhiOS v0.68: pin canonical upstream license evidence for four native dependencies

[MichaelWave369]

Draft evidence-only v0.68. Builds on the merged v0.67 Linux npm license census and strictly retains all four human-review flags. Captures immutable Git source and blob SHA pins for @esbuild/linux-x64, @rollup/rollup-linux-x64-gnu, @rolldown/binding-linux-x64-gnu, and @napi-rs/lzma-linux-x64-gnu at their exact reviewed versions. GitHub CI cross-checks the current installed-package census and fetches only exact version-pinned raw source files, verifying Git blob hashes. Three have root license files; LZMA's pinned source has only the package.json MIT declaration and stays unresolved. Rollup's combined third-party notices likewise remain under review. Includes fail-closed tests, human review notes, and JSON hashes but never copies upstream legal text or grants installer, redistribution, model/provider or DONE authority. Keep draft until CI/qualification and human review. No auto merge.

[MichaelWave369]

v0.68 immutable upstream source proof: PASS on exact PR HEAD

HEAD 5c28d0d41c2d3b39d7968b6c4cee32a5d66c0902. Frontend source review and byte-replay CI: SUCCESS. Detailed JSON evidence artifact.

The exact four v0.67 unresolved Linux x64 native packages were re-identified against Vessie's and ThinkTank's reviewed immutable source SHA and SHA-256 npm lock snapshots; no extra flags or changed versions were silently accepted. CI fetched all four immutable GitHub source documents without redirects and independently rehashed the Git blob contents at their version-pinned commits. Verified three upstream legal files: evanw/esbuild LICENSE.md at v0.25.12 commit 208f5399...; rollup/rollup composite LICENSE.md at v4.64.5 commit 05a2938...; rolldown/rolldown LICENSE at v1.2.13 commit f7de35f.... For @napi-rs/lzma-linux-x64-gnu@1.5.1, verified the parent Brooooooklyn/lzma v1.5.1 commit f164df9... package.json with an MIT declaration only, not a standalone root license file. Rollup's included notices need separate human reconciliation. Native binary provenance, transitive Rust obligations, notice bundling, and redistribution permission remain unverified.

The v0.66 independent Vessie/ThinkTank production bundle replay still passed byte for byte. The first #317 attempt failed on Python's standalone import path and was corrected by moving reviewed root-path setup before the import; no authorization gate, manifest pin or expected-review set was weakened.

Held: license clearance=false; native binary provenance=false; installer/desktop grant=false; model execution=false; external DONE=false. Keep PR draft until separate PhiOS qualification and Trellis offline-browser CI complete successfully and operator approves. Ledger Above Ego. DONE Means Verified.